BILL NUMBER: AB 2028	AMENDED
	BILL TEXT

	AMENDED IN SENATE  JUNE 3, 2010
	AMENDED IN ASSEMBLY  APRIL 13, 2010
	AMENDED IN ASSEMBLY  MARCH 10, 2010

INTRODUCED BY   Assembly Member Hernandez

                        FEBRUARY 17, 2010

   An act to amend Sections 56.10 and 56.104 of the Civil Code,
relating to medical information.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 2028, as amended, Hernandez. Confidentiality of medical
information: disclosure.
   Existing law specifies certain agencies to which mandated reports
of suspected child abuse or neglect shall be made. Existing law
authorizes information relevant to the incident of child abuse or
neglect to be given to an investigator from an agency that is
investigating the case, as provided. Existing law also authorizes
information relevant to the incident of elder or dependent adult
abuse to be given to an investigator from an agency investigating the
case, as provided.
   Existing law, the Confidentiality of Medical Information Act,
prohibits a health care provider, a contractor, or a health care
service plan from disclosing medical information, as defined,
regarding a patient of the provider or an enrollee or subscriber of
the health care service plan without first obtaining an
authorization, except as specified. Existing law makes a violation of
the act that results in economic loss or personal injury to a
patient a misdemeanor.
   This bill would authorize a health care provider or a health care
service plan to disclose information relevant to the incident of
child abuse or neglect, or to the incident of elder or dependent
adult abuse, that may be given to an investigator from an agency
investigating the case, including the investigation report and other
pertinent materials that may be given to the licensing agency. By
changing the definition of a crime, the bill would impose a
state-mandated local program.
   Existing law prohibits providers of health care, health care
service plans, and contractors from releasing medical information to
persons authorized by law to receive that information if the
information specifically relates to a patient's participation in
outpatient treatment with a psychotherapist, unless the requester of
the information submits a specified written request for the
information to the patient and to the provider of health care, health
care service plan, or contractor. However, existing law excepts from
those provisions specified disclosures that are made for the purpose
of diagnosis or treatment of a patient or that are made to prevent
or lessen a serious and imminent threat to the health or safety of a
reasonably foreseeable victim or victims.
   This bill would also except from these provisions disclosures that
are specifically authorized by law, including, but not limited to
disclosures made to the federal Food and Drug Administration of
adverse events related to drug products or medical devices or
disclosures that authorize a health care provider or a health care
service plan to disclose information relevant to the incident of
child abuse or neglect, or to the incident of elder or dependent
adult abuse, in the report that may be given to an investigator from
an agency investigating the case  or by a mandated reporter, as
provided  .
   The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
   This bill would provide that no reimbursement is required by this
act for a specified reason.
   Vote: majority. Appropriation: no. Fiscal committee: yes.
State-mandated local program: yes.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
another provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
deaths, suspicious deaths, unknown deaths, or criminal deaths, or
when otherwise authorized by the decedent's representative. Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient. This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made. If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient. The information may also be disclosed to another provider of
health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to a person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, information so disclosed shall not be
further disclosed by the recipient in a way that would violate this
part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of a provider of health care
or health care service plan may be reviewed by a private or public
body responsible for licensing or accrediting the provider of health
care or health care service plan. However, no patient-identifying
medical information may be removed from the premises except as
expressly permitted or required elsewhere by law, nor shall that
information be further disclosed by the recipient in a way that would
violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes. However, no information so disclosed shall be
further disclosed by the recipient in a way that would disclose the
identity of a patient or violate this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a lawsuit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or a health care service
plan is notified in writing of an agreement by the sponsor, insurer,
or administrator to the contrary, the information may be disclosed to
a sponsor, insurer, or administrator of a group or individual
insured or uninsured plan or policy that the patient seeks coverage
by or benefits from, if the information was created by the provider
of health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan. Medical information shall
not otherwise be disclosed by a health care service plan except in
accordance with this part.
   (11) This part does not prevent the disclosure by a provider of
health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of
the Insurance Code, of medical information if the insurance
institution, agent, or support organization has complied with all of
the requirements for obtaining the information pursuant to Article
6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division
1 of the Insurance Code.
   (12) The information relevant to the patient's condition, care,
and treatment provided may be disclosed to a probate court
investigator in the course of an investigation required or authorized
in a conservatorship proceeding under the
Guardianship-Conservatorship Law as defined in Section 1400 of the
Probate Code, or to a probate court investigator, probation officer,
or domestic relations investigator engaged in determining the need
for an initial guardianship or continuation of an existing
guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant. For the purpose of this paragraph, "tissue bank" and
"tissue" have the same meanings as defined in Section 1635 of the
Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, including, but not limited
to, the voluntary reporting, either directly or indirectly, to the
federal Food and Drug Administration of adverse events related to
drug products or medical device problems  , or to disclosures
made pursuant to subdivisions (b) and (c) of Section 11167 of th
  e Penal Code by a person required to make a report
pursuant to Sections 11165.9 and 11166 of the Penal Code  .
   (15) Basic information, including the patient's name, city of
residence, age, sex, and general condition, may be disclosed to a
state-recognized or federally recognized disaster relief organization
for the purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in a way that would violate this part, including the
unauthorized manipulation of coded or encrypted medical information
that reveals individually identifiable medical information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows: (A) to an entity contracting
with a health care service plan or the health care service plan's
contractors to monitor or administer care of enrollees for a covered
benefit, if the disease management services and care are authorized
by a treating physician, or (B) to a disease management organization,
as defined in Section 1399.900 of the Health and Safety Code, that
complies fully with the physician authorization requirements of
Section 1399.902 of the Health and Safety Code, if the health care
service plan or its contractor provides or has provided a description
of the disease management services to a treating physician or to the
health care service plan's or contractor's network of physicians.
This paragraph does not require physician authorization for the care
or treatment of the adherents of a well-recognized church or
religious denomination who depend solely upon prayer or spiritual
means for healing in the practice of the religion of that church or
denomination.
   (18) The information may be disclosed, as permitted by state and
federal law or regulation, to a local health department for the
purpose of preventing or controlling disease, injury, or disability,
including, but not limited to, the reporting of disease, injury,
vital events, including, but not limited to, birth or death, and the
conduct of public health surveillance, public health investigations,
and public health interventions, as authorized or required by state
or federal law or regulation.
   (19) The information may be disclosed, consistent with applicable
law and standards of ethical conduct, by a psychotherapist, as
defined in Section 1010 of the Evidence Code, if the psychotherapist,
in good faith, believes the disclosure is necessary to prevent or
lessen a serious and imminent threat to the health or safety of a
reasonably foreseeable victim or victims, and the disclosure is made
to a person or persons reasonably able to prevent or lessen the
threat, including the target of the threat.
   (20) The information may be disclosed as described in Section
56.103.
   (21) (A) The information may be disclosed to an employee welfare
benefit plan, as defined under Section 3(1) of the Employee
Retirement Income Security Act of 1974 (29 U.S.C. Sec. 1002(1)),
which is formed under Section 302(c)(5) of the Taft-Hartley Act (29
U.S.C. Sec. 186(c)(5)), to the extent that the employee welfare
benefit plan provides medical care, and may also be disclosed to an
entity contracting with the employee welfare benefit plan for
billing, claims management, medical data processing, or other
administrative services related to the provision of medical care to
persons enrolled in the employee welfare benefit plan for health care
coverage, if all of the following conditions are met:
   (i) The disclosure is for the purpose of determining eligibility,
coordinating benefits, or allowing the employee welfare benefit plan,
or the contracting entity, to advocate on the behalf of a patient or
enrollee with a provider, a health care service plan, or a state or
federal regulatory agency.
   (ii) The request for the information is accompanied by a written
authorization for the release of the information submitted in a
manner consistent with subdivision (a) and Section 56.11.
   (iii) The disclosure is authorized by and made in a manner
consistent with the Health Insurance Portability and Accountability
Act of 1996 (Public Law 104-191).
   (iv) Any information disclosed is not further used or disclosed by
the recipient in any way that would directly or indirectly violate
this part or the restrictions imposed by Part 164 of Title 45 of the
Code of Federal Regulations, including the manipulation of the
information in any way that might reveal individually identifiable
medical information.
   (B) For purposes of this paragraph, Section 1374.8 of the Health
and Safety Code shall not apply.
   (22) Information may be disclosed pursuant to 
subdivisions (b) and (d) of Section 11167 of the Penal Code or
 subdivision (a) of Section 15633.5 of the Welfare and
Institutions Code  by a person required to make a report pursuant
to Section 15630 of the Welfare and Institutions Code. Covered
entities, as they are defined in Section 160.103 of Title 45 of the
Code of Federal Regulations, shall comply with the requirements of
the Health Insurance Portability and Accountability Act (HIPAA)
privacy rule pursuant to subsection (c) of Section 164.512 of Title
45 of the Code of Federal Regulations if the disclosure is not for
the purpose of public health surveillance, investigation,
intervention, or reporting an injury or   death  .
   (d) Except to the extent expressly authorized by a patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), a
provider of health care, health care service plan, contractor, or
corporation and its subsidiaries and affiliates shall not
intentionally share, sell, use for marketing, or otherwise use
medical information for a purpose not necessary to provide health
care services to the patient.
   (e) Except to the extent expressly authorized by a patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), a
contractor or corporation and its subsidiaries and affiliates shall
not further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to a person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 2.  Section 56.104 of the Civil Code is amended to read:
   56.104.  (a) Notwithstanding subdivision (c) of Section 56.10,
except as provided in subdivision (e), no provider of health care,
health care service plan, or contractor may release medical
information to persons or entities who have requested that
information and who are authorized by law to receive that information
pursuant to subdivision (c) of Section 56.10, if the requested
information specifically relates to the patient's participation in
outpatient treatment with a psychotherapist, unless the person or
entity requesting that information submits to the patient pursuant to
subdivision (b) and to the provider of health care, health care
service plan, or contractor a written request, signed by the person
requesting the information or an authorized agent of the entity
requesting the information, that includes all of the following:
   (1) The specific information relating to a patient's participation
in outpatient treatment with a psychotherapist being requested and
its specific intended use or uses.
   (2) The length of time during which the information will be kept
before being destroyed or disposed of. A person or entity may extend
that timeframe, provided that the person or entity notifies the
provider, plan, or contractor of the extension. Any notification of
an extension shall include the specific reason for the extension, the
intended use or uses of the information during the extended time,
and the expected date of the destruction of the information.
   (3) A statement that the information will not be used for any
purpose other than its intended use.
   (4) A statement that the person or entity requesting the
information will destroy the information and all copies in the person'
s or entity's possession or control, will cause it to be destroyed,
or will return the information and all copies of it before or
immediately after the length of time specified in paragraph (2) has
expired.
   (b) The person or entity requesting the information shall submit a
copy of the written request required by this section to the patient
within 30 days of receipt of the information requested, unless the
patient has signed a written waiver in the form of a letter signed
and submitted by the patient to the provider of health care or health
care service plan waiving notification.
   (c) For purposes of this section, "psychotherapist" means a person
who is both a "psychotherapist" as defined in Section 1010 of the
Evidence Code and a "provider of health care" as defined in
subdivision (i) of Section 56.05.
   (d) This section does not apply to the disclosure or use of
medical information by a law enforcement agency or a regulatory
agency when required for an investigation of unlawful activity or for
licensing, certification, or regulatory purposes, unless the
disclosure is otherwise prohibited by law.
   (e) This section shall not apply to either  
any  of the following:
   (1) Information authorized to be disclosed pursuant to paragraph
(1) of subdivision (c) of Section 56.10.
   (2) Information requested  from a psychotherapist  by law
enforcement or by the target of the threat subsequent to a
disclosure  by the psychotherapist  authorized by paragraph
(19) of subdivision (c) of Section 56.10, in which the additional
information is clearly necessary to prevent the serious and imminent
threat disclosed under that paragraph.
   (3) Information disclosed by a psychotherapist pursuant to
 paragraph (22)   paragraphs (14) and (22) 
of subdivision (c) of Section 56.10.
   (f) Nothing in this section shall be construed to grant any
additional authority to a provider of health care, health care
service plan, or contractor to disclose information to a person or
entity without the patient's consent.
  SEC. 3.  No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution because
the only costs that may be incurred by a local agency or school
district will be incurred because this act creates a new crime or
infraction, eliminates a crime or infraction, or changes the penalty
for a crime or infraction, within the meaning of Section 17556 of the
Government Code, or changes the definition of a crime within the
meaning of Section 6 of Article XIII B of the California
Constitution.